Fake Recruiters Steal Corporate Logins on Mobile

Scammers posing as HR staff at major brands are luring targets into an interview “scheduling” flow that ultimately steals corporate passwords on mobile devices. The campaign uses a browser-in-the-browser style approach (or a full-screen fake login on phones) and even blocks personal email logins to focus only on high-value corporate accounts.

Key findings

• Scammers impersonate HR/recruiters and use interview scheduling as the lure to capture corporate passwords.
• On mobile, the kit uses a full-screen fake login (no address bar) to remove easy legitimacy checks.
• The phishing kit filters out personal email addresses and only allows corporate credentials to proceed.
• Zimperium tracked brand-impersonation domains for a year and found common hosting/ASN patterns, frequently involving AWS and SEDO GmbH.
• The campaign impersonates a wide range of brands across multiple industries.

Who’s being targeted

• Commonly targeted roles: All employees, HR/Recruiting, Executives, IT/Identity & Access Management, Mobile device users.
• Affected industries: E-commerce, Luxury goods, Aviation, Retail, Professional services.
• Attack channels: website.
• Impersonated: HR staff at a well-known company (recruiting team).

Awareness takeaways

• Treat unsolicited interview/scheduling links as high-risk, verify the recruiter and company using a trusted channel before signing in.
• Be extra cautious with mobile logins: a full-screen sign-in page can hide key trust signals, making fake login pages harder to detect.
• If a page refuses personal email and insists on corporate credentials, assume it may be targeting enterprise access and stop to verify.
• Warn staff about brand lookalike domains (e.g., “-careers” / “-global”) and encourage reporting quickly, since blocklists may lag.

Red flags to watch for

• Login page is full-screen on mobile with no visible address bar to verify the real site
• Site blocks personal email accounts and insists on corporate credentials
• Lookalike domains that mimic brands (e.g., “[company]-careers.com”)